Managing Negotiations and Vendors GSLC Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A company is terminating a contract with a security vendor due to a merger. The vendor has access to sensitive data and the company is concerned about data retention and deletion. The contract includes a clause that requires the vendor to delete all data within 30 days of termination. What is the best way to ensure compliance?

   • ARequire the vendor to provide a certificate of deletion and conduct a third-party audit.
   • BIgnore the clause because the vendor is reputable.
   • CTrust the vendor to delete the data and request a confirmation letter.
   • DAsk the vendor to return all data and then delete it.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Why is it important to negotiate the terms and conditions of a vendor contract?

   • ATo make the contract as long as possible
   • BTo transfer all risks to the vendor
   • CTo ensure the contract is legally binding
   • DTo align the contract with the organization's needs and risk tolerance
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A security team has contracted with a vulnerability management vendor that promises to remediate critical vulnerabilities within 48 hours. The team wants to evaluate the vendor's performance objectively. Which approach is MOST effective for evaluating the vendor against this commitment?

   • AReview the vendor's marketing materials to confirm their remediation capabilities.
   • BAsk the vendor for a summary of their remediation activities at the end of the quarter.
   • CTrack the time from vulnerability discovery to remediation for each critical vulnerability and compare it to the 48-hour SLA.
   • DConduct a penetration test at the end of the year to see if any critical vulnerabilities remain.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A company is negotiating a contract with a vendor that will handle sensitive customer data. The vendor's standard contract includes a clause that allows them to subcontract services without prior approval. The security manager is concerned about data protection. What contract term should the security manager insist on?

   • AA clause that the vendor must use only subcontractors located in the same country.
   • BA clause requiring prior written approval for any subcontracting and that subcontractors meet the same security requirements.
   • CA clause requiring the vendor to notify the company of any subcontractors within 30 days after they are engaged.
   • DA clause that the vendor remains liable for all subcontractor actions.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A company is negotiating a contract with a new cloud security vendor. The vendor's standard terms include a limitation of liability clause that caps damages at the total fees paid over the past 12 months. The company's legal team insists on a higher cap to cover potential breach-related costs. The vendor refuses to change the cap but offers a discount on the first year. What should the security manager recommend?

   • AAccept the cap but require the vendor to purchase cyber insurance.
   • BReject the vendor entirely because they will not change the cap.
   • CAccept the standard cap and the discount, as the cap is industry standard.
   • DNegotiate for a higher cap or a carve-out for breaches of confidentiality or data protection obligations.
   Reveal Solution Discussion Select an answer first